# Authentication

Every request to `https://api.motorsdynamic.com/api/v2` carries an API key. Create and revoke keys in the [dashboard](https://developers.motorsdynamic.com/dashboard).

## Send the key

| Method | Example |
| --- | --- |
| Header (recommended) | `x-api-key: md_dev_...` |
| Bearer token | `Authorization: Bearer md_dev_...` |
| Query parameter, for a quick test in the browser | `?apiKey=md_dev_...` |

```bash
curl "https://api.motorsdynamic.com/api/v2/vin/1HGCM82633A004352" -H "x-api-key: $MD_API_KEY"
```

## Keep keys safe

- A key is shown once, when you create it. We store only a hash.
- Use one key per app or environment. An account holds up to 10 active keys, and usage is reported per key.
- Revoking a key takes effect immediately.
- Call the API from your server. A key in browser or mobile code can be copied by anyone.

## AI agents

Agents connect through the [hosted MCP server](https://developers.motorsdynamic.com/docs/mcp) and sign in with OAuth. The agent never holds an API key, and its calls count against the same plan.